Browser Extension Security: How to Audit Permissions Before Installing

The average browser extension asks for permissions that would make a locksmith nervous. That harmless-looking "dark mode toggle" you installed last week? There's a decent chance it requested the ability to read and change data on every website you visit. Most people click "Add extension" without a second glance, and that single moment of trust is exactly what attackers count on.

Here's a number that should stick with you: security researchers have repeatedly found that a meaningful slice of popular extensions either over-request permissions or get sold to shady buyers who quietly push malicious updates to an existing, trusting user base. In 2023, a widely reported cluster of malicious Chrome extensions racked up tens of millions of installs before being pulled. The scary part is that many of them started life as legitimate, useful tools.

This guide walks you through exactly how to audit browser extension permissions before you install anything, how to read what those permissions actually mean, and how to keep an eye on the extensions you already trust. You'll get a repeatable checklist, a comparison of the major browsers' permission models, and a real worked example so you can practice on a live extension today.

Key Takeaways

• Permissions are the real risk surface. An extension can only do what its permissions allow, so the permission list is your single most important pre-install signal.
• "Read and change all your data on all websites" is the red flag. Treat this broad grant as guilty until proven necessary.
• Match permissions to purpose. A screenshot tool needs activeTab, not access to your browsing history and cookies.
• Audit after install, not just before. Extensions update silently and ownership changes, so re-check permissions every few months.
• Fewer extensions, better sources. Each add-on is an attack surface; install less, and prefer vendors who publish source or a privacy policy.

Why Browser Extension Permissions Matter More Than You Think

An extension runs inside your browser with a level of access that a normal website could never get. Depending on what it's granted, it can read the pages you visit, inject scripts, capture form input, access your cookies, and phone home to a remote server. In practical terms, a compromised extension can steal session tokens, harvest passwords as you type them, and rewrite the pages you see.

The core idea is simple: an extension's capabilities are defined entirely by its permissions. If it doesn't have permission to read your data on all sites, it can't. That's why the permission prompt is not boilerplate to click through. It's the security contract.

Two things make this dangerous in the real world:

• Silent updates. Once installed, most extensions update automatically. A tool you vetted last year can ship new code tomorrow without asking again, as long as it stays within its already-granted permissions.
• Ownership changes. Popular extensions get bought. The new owner inherits your trust and your install base. This is the exact pattern behind several high-profile adware and data-theft incidents.

If you care about the security of your whole stack, extensions belong in the same conversation as server hardening and plugin vetting. The same discipline we apply when we vet AI-generated code before shipping it should apply to any third-party code running in your browser.

What Each Permission Actually Means

Browser permission language is deliberately plain, which unfortunately makes it easy to skim. Here's what the common grants really allow.

The high-risk permissions

• Read and change all your data on all websites (<all_urls> or *://*/*): The nuclear option. The extension can see and modify every page, including your bank, email, and admin panels. Only trust this when the extension genuinely needs to work everywhere (an ad blocker, a password manager).
• Read your browsing history (history): Full access to everywhere you've been. Rarely needed outside of history-management tools.
• Access your data for a specific site (*://*.example.com/*): Scoped access. Much safer because it's limited to one domain.
• Read and change cookies (cookies): Session tokens live here. Combined with broad host access, this can mean account takeover.
• Manage your downloads (downloads): Can save files to your machine, which is a delivery path for malware if abused.

The lower-risk permissions

• activeTab: Access to the current tab only, and only when you click the extension. This is the gold standard for a well-behaved tool.
• storage: Lets the extension save its own settings locally. Almost universal and low concern.
• notifications: Can show system notifications. Annoying at worst.
• contextMenus: Adds right-click menu items. Harmless.

The key mental model: ask "does the stated feature require this?" A currency converter that only activates when you highlight text should be using activeTab, not <all_urls>. When the permission is broader than the feature, that gap is where risk lives.

A Worked Example: Auditing a "PDF Merger" Extension

Let's make this concrete. Say you find a free extension called "Quick PDF Merger" with 400,000 users and a 4.6-star rating. Looks trustworthy. Here's the audit I'd actually run before installing.

1. Read the permission list on the store page. Suppose it requests: Read and change all your data on all websites, Read your browsing history, and storage. Stop right there. A tool that merges PDF files has no reason to read every website or your history. The stated function needs, at most, activeTab and maybe downloads.
2. Check the developer. Click the developer name. Do they have a website? A privacy policy? Other extensions? A merger tool published by a nameless developer with no site and one product is a warning sign.
3. Read the 1-star and 3-star reviews, not the 5-star ones. Sort reviews by lowest. Look for "started showing ads," "redirected my searches," or "changed after an update." These phrases signal a hijack pattern.
4. Check the last update date. An extension untouched for three years may have unpatched vulnerabilities. One updated yesterday with a sudden permission expansion is suspicious in the other direction.
5. Search "<extension name> malware" and "<developer> scam." Thirty seconds of searching surfaces most known-bad tools. Community forums flag these fast.
6. Look for an open-source or paid alternative. A reputable paid tool has a business model that isn't your data. Free tools that request everything often monetize by selling what they collect.

The verdict: This hypothetical PDF Merger fails on step one. The permission-to-function mismatch is enough to walk away, no matter how good the rating looks. Ratings measure how well software works, not how safely it behaves.

Browser Extension Permission Models Compared

Not all browsers handle permissions the same way. Some let you restrict access per-site; others are more all-or-nothing. If security is a priority, the browser you choose changes what controls you have.

Browser	Per-site permission control	Manifest V3 (limits broad access)	Re-review on update	Store vetting
Chrome	Yes (On click / On specific sites / On all sites)	Enforced	Only if new permissions added	Automated + some manual
Firefox	Yes, granular per-extension host control	Supported, less strict	Prompts on new permissions	Manual review for recommended
Edge	Yes (inherits Chromium controls)	Enforced	Only if new permissions added	Automated + Microsoft review
Brave	Yes (Chromium-based controls)	Enforced	Only if new permissions added	Uses Chrome store + own checks
Safari	Yes, prompts per-site frequently	N/A (uses App Extensions)	App Store review	Strict App Store review

The practical takeaway: on any Chromium browser, you can set an extension to "On click" so it only activates when you tell it to. This one setting neutralizes a huge chunk of risk from broadly-permissioned extensions. Firefox and Safari lean toward tighter default prompting, which some privacy-focused users prefer.

A Step-by-Step Permission Audit Checklist

Here's the repeatable process. Run it before every install and again during a periodic cleanup.

Before you install

1. Read every requested permission. Write down each one and ask whether the feature truly needs it.
2. Flag any "all sites" or "history" grant that doesn't match the tool's purpose. Mismatch equals no install.
3. Verify the developer identity. Real website, privacy policy, contact method, and ideally other well-reviewed products.
4. Check install count and review trend. Read low-star reviews for hijack complaints.
5. Confirm recent, sane updates. Active maintenance without sudden permission creep.
6. Search for known issues. A quick web search for the name plus "malware."

After you install

1. Set host access to "On click" or a specific site wherever the extension allows it.
2. Open your browser's extension manager (chrome://extensions, about:addons, or the equivalent) and review each entry.
3. Remove anything you haven't used in 30 days. Dormant extensions are pure risk with zero benefit.
4. Turn off "allow in incognito/private" unless you specifically need it.
5. Re-audit quarterly. Put a recurring reminder on your calendar. Ownership and code change over time.

This mirrors the layered defense mindset we recommend for websites too. If you run WordPress, tools like Cover image: Software value feedback loop by jakuza, licensed under BY-SA 2.0 via Openverse.